2026-05-23_42755e22d31f6761981d4d39ae451e67_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-23_42755e22d31f6761981d4d39ae451e67_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc
Size 1.7MB
Sample260523-cremfabs2k
SHA256 966bfe64e6cf726494a9db9a018c081e92a53e279cef275e625e5cfa0984168c
MD5 42755e22d31f6761981d4d39ae451e67
SHA1 d46482cd86b3fb734ef2715b07ac04266b2c929b
SHA512 697129e4fe3b127ae0f94058577767616c5d2230c4654e56c75ee5b4a31175d9c53aa33ef302eace012463997435ce09ec6920c7a4bc00f15902b7b7f53cd029
SSDEEP 24576:+vk4qoD5h+KPXFeRU4gt+pwInTv8qK1cXMK092wVMdhKNOtIl8:+8hkXF2Nrpfnod1I09p8UNO
TLSH
T1FC85CF47B3A512E9C463D578CAB2E623E732BC5A071186CF33C04A697FA76E05D76B01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-23_42755e22d31f6761981d4d39ae451e67_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

File Explorer

2026-05-23_42755e22d31f6761981d4d39ae451e67_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

.exe 1.7MB

2026-05-23_42755e22d31f6761981d4d39ae451e67_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

IMPHASH 28bab851cf9c5f7f7c1748de640c8fec
SHA256 966bfe64e6cf726494a9db9a018c081e92a53e279cef275e625e5cfa0984168c
MD5 42755e22d31f6761981d4d39ae451e67
SHA1 d46482cd86b3fb734ef2715b07ac04266b2c929b
SHA512 697129e4fe3b127ae0f94058577767616c5d2230c4654e56c75ee5b4a31175d9c53aa33ef302eace012463997435ce09ec6920c7a4bc00f15902b7b7f53cd029
SSDEEP 24576:+vk4qoD5h+KPXFeRU4gt+pwInTv8qK1cXMK092wVMdhKNOtIl8:+8hkXF2Nrpfnod1I09p8UNO
TLSH
T1FC85CF47B3A512E9C463D578CAB2E623E732BC5A071186CF33C04A697FA76E05D76B01
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

477120

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

user32

PeekMessageW DispatchMessageW RegisterClassExW CreateWindowExW TranslateMessage ShowWindow SetWindowPos OpenClipboard CloseClipboard DefWindowProcW PostQuitMessage DestroyWindow SetCapture SetClipboardData ScreenToClient ClientToScreen SetCursor SetCursorPos GetClientRect GetForegroundWindow IsWindowUnicode ReleaseCapture EmptyClipboard GetCapture GetKeyState GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout GetClipboardData LoadCursorW GetCursorPos GetWindowRect SetWindowRgn UpdateWindow GetSystemMetrics UnregisterClassW

gdi32

CreateRoundRectRgn

shell32

SHGetFolderPathA

advapi32

OpenSCManagerW GetUserNameA RegCloseKey RegCreateKeyExA RegDeleteKeyA RegOpenKeyExA RegOpenKeyExW RegQueryValueExA ChangeServiceConfigW ChangeServiceConfig2W CloseServiceHandle ControlService CreateServiceW DeleteService RegSetValueExA ConvertStringSecurityDescriptorToSecurityDescriptorA StartServiceW SetServiceObjectSecurity QueryServiceStatus OpenServiceW

iphlpapi

GetAdaptersAddresses

ole32

CoCreateGuid

wininet

InternetOpenA InternetCloseHandle InternetConnectA InternetReadFile HttpOpenRequestA HttpSendRequestA

crypt32

CertOpenStore CertCloseStore CertEnumCertificatesInStore CertAddCertificateContextToStore CryptQueryObject CryptMsgClose

kernel32

HeapAlloc UnhandledExceptionFilter IsDebuggerPresent VirtualProtect LoadLibraryExW RtlVirtualUnwind RtlCaptureContext LCMapStringW GetLocaleInfoW IsValidLocale HeapFree EnumSystemLocalesW FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx ReadConsoleW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetUserDefaultLCID GetFileType GetStdHandle GetModuleFileNameW ExitProcess GetCurrentProcess IsProcessorFeaturePresent GetModuleHandleExW FreeLibraryAndExitThread GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap CreateDirectoryA CreateFileA CreateFileW DeleteFileA GetFileAttributesA GetFullPathNameW GetVolumeInformationW ReadFile SetFilePointerEx WriteFile GetTempPathA CloseHandle SetHandleInformation GetLastError CreatePipe PeekNamedPipe DeviceIoControl WaitForSingleObject CreateMutexW Sleep GetCurrentProcessId TerminateProcess CreateProcessA GlobalMemoryStatusEx GetSystemInfo GetSystemTimeAsFileTime GetTickCount GetTickCount64 GetModuleFileNameA GetModuleHandleW GetProcAddress LoadResource LockResource SizeofResource RtlUnwind LoadLibraryA GlobalAlloc GlobalUnlock GlobalLock LocalFree MoveFileExA GetComputerNameA WideCharToMultiByte GetSystemDirectoryA FreeLibrary GetModuleHandleA LoadLibraryExA MoveFileExW K32EnumDeviceDrivers K32GetDeviceDriverBaseNameA GlobalFree MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency GetLocaleInfoA GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetSystemTimePreciseAsFileTime WakeAllConditionVariable EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW InitializeSListHead ExitThread SetStdHandle HeapSize WriteConsoleW SetEndOfFile FindResourceW CreateThread FlsFree FlsSetValue FlsGetValue RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc

imm32

ImmReleaseContext ImmGetContext ImmSetCandidateWindow ImmSetCompositionWindow

Name

.text

Size

663KB

Virtual Size

662KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

174KB

Virtual Size

174KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

813KB

Virtual Size

813KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-23_42755e22d31f6761981d4d39ae451e67_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

d3d11

d3dcompiler_47

user32

gdi32

shell32

advapi32

iphlpapi

ole32

wininet

crypt32

kernel32

imm32

generic